tor-browser

commit 38649b6a949a8bc0f9e28187eeb81c1ecafefc9d
parent e3c22d4741ec8f00e34fcd70abb8edfc7d4fe64d
Author: Michael Kaply <345868+mkaply@users.noreply.github.com>
Date:   Mon, 27 Oct 2025 16:12:51 +0000

Bug 1992716 - Properly lock/unlock allow list. r=emz

Differential Revision: https://phabricator.services.mozilla.com/D269290

Diffstat:
M
browser/components/enterprisepolicies/Policies.sys.mjs
 | 
34
+++++++++++++++++-----------------
A
browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser.toml
 | 
5
+++++
A
browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser_policy_trackingprotection.js
 | 
56
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
browser/components/enterprisepolicies/tests/browser/trackingprotection2/trackingprotection.json
 | 
8
++++++++
M
browser/components/enterprisepolicies/tests/moz.build
 | 
1
+

5 files changed, 87 insertions(+), 17 deletions(-)
diff --git a/browser/components/enterprisepolicies/Policies.sys.mjs b/browser/components/enterprisepolicies/Policies.sys.mjs
@@ -1258,7 +1258,7 @@ export var Policies = {
         ContentBlockingPrefs.matchCBCategory();
         // We don't want to lock the new exceptions UI unless
         // that policy was explicitly set.
-        if (param.Category == "strict") {
+        if (param.Category == "strict" && !param.Locked) {
           Services.prefs.unlockPref(
             "privacy.trackingprotection.allow_list.baseline.enabled"
           );
@@ -1272,8 +1272,23 @@ export var Policies = {
       if ("Exceptions" in param) {
         addAllowDenyPermissions("trackingprotection", param.Exceptions);
       }
+      if ("BaselineExceptions" in param) {
+        PoliciesUtils.setDefaultPref(
+          "privacy.trackingprotection.allow_list.baseline.enabled",
+          param.BaselineExceptions,
+          param.Locked
+        );
+      }
+      if ("ConvenienceExceptions" in param) {
+        PoliciesUtils.setDefaultPref(
+          "privacy.trackingprotection.allow_list.convenience.enabled",
+          param.ConvenienceExceptions,
+          param.Locked
+        );
+      }
       if (param.Category) {
-        // If a category is set, we ignore everything except exceptions.
+        // If a category is set, we ignore everything except exceptions
+        // and the allow lists.
         return;
       }
       if (param.Value) {
@@ -1329,21 +1344,6 @@ export var Policies = {
           param.Locked
         );
       }
-      if ("BaselineExceptions" in param) {
-        PoliciesUtils.setDefaultPref(
-          "privacy.trackingprotection.allow_list.baseline.enabled",
-          param.BaselineExceptions,
-          param.Locked
-        );
-      }
-
-      if ("ConvenienceExceptions" in param) {
-        PoliciesUtils.setDefaultPref(
-          "privacy.trackingprotection.allow_list.convenience.enabled",
-          param.ConvenienceExceptions,
-          param.Locked
-        );
-      }
     },
   },
 
diff --git a/browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser.toml b/browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser.toml
@@ -0,0 +1,5 @@
+[DEFAULT]
+prefs = ["browser.policies.alternatePath='<test-root>/browser/components/enterprisepolicies/tests/browser/trackingprotection2/trackingprotection.json'", "privacy.trackingprotection.allow_list.hasMigratedCategoryPrefs=true"]
+support-files = ["trackingprotection.json"]
+
+["browser_policy_trackingprotection.js"]
diff --git a/browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser_policy_trackingprotection.js b/browser/components/enterprisepolicies/tests/browser/trackingprotection2/browser_policy_trackingprotection.js
@@ -0,0 +1,56 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+add_task(async function test_enabletrackingprotection_strict() {
+  await BrowserTestUtils.withNewTab(
+    "about:preferences#privacy",
+    async browser => {
+      let strictRadio = browser.contentDocument.getElementById("strictRadio");
+      is(strictRadio.selected, true, "Strict checkbox should be selected");
+      is(strictRadio.disabled, true, "Strict checkbox should be disabled");
+    }
+  );
+});
+
+add_task(async function test_enabletrackingprotection_strict_preferences() {
+  is(
+    Services.prefs.prefIsLocked("privacy.trackingprotection.enabled"),
+    true,
+    "Preference should be locked"
+  );
+  is(
+    Services.prefs.getBoolPref("privacy.trackingprotection.enabled"),
+    true,
+    "Preference should be true"
+  );
+  is(
+    Services.prefs.prefIsLocked(
+      "privacy.trackingprotection.allow_list.baseline.enabled"
+    ),
+    true,
+    "Preference should be locked"
+  );
+  is(
+    Services.prefs.prefIsLocked(
+      "privacy.trackingprotection.allow_list.convenience.enabled"
+    ),
+    true,
+    "Preference should be locked"
+  );
+  is(
+    Services.prefs.getBoolPref(
+      "privacy.trackingprotection.allow_list.baseline.enabled"
+    ),
+    true,
+    "Default value for privacy.trackingprotection.allow_list.baseline.enabled should be true"
+  );
+  is(
+    Services.prefs.getBoolPref(
+      "privacy.trackingprotection.allow_list.convenience.enabled"
+    ),
+    false,
+    "Default value for privacy.trackingprotection.allow_list.convenience.enabled should be false"
+  );
+});
diff --git a/browser/components/enterprisepolicies/tests/browser/trackingprotection2/trackingprotection.json b/browser/components/enterprisepolicies/tests/browser/trackingprotection2/trackingprotection.json
@@ -0,0 +1,8 @@
+{
+  "policies": {
+    "EnableTrackingProtection": {
+      "Category": "strict",
+      "Locked": true
+    }
+  }
+}
diff --git a/browser/components/enterprisepolicies/tests/moz.build b/browser/components/enterprisepolicies/tests/moz.build
@@ -16,6 +16,7 @@ BROWSER_CHROME_MANIFESTS += [
     "browser/managedbookmarks/browser.toml",
     "browser/show_home_button/browser.toml",
     "browser/trackingprotection/browser.toml",
+    "browser/trackingprotection2/browser.toml",
 ]
 
 XPCSHELL_TESTS_MANIFESTS += ["xpcshell/xpcshell.toml"]